home

installer_directx_spanish.exe

Ronekudeb

MaxSpeedy (New Media Holdings Ltd.)

The application installer_directx_spanish.exe, “Ronekudeb Setup ” by MaxSpeedy (New Media Holdings) has been detected as adware by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the installCore installer. The file has been seen being downloaded from www.bundlebitscontent.com and multiple other hosts.
Publisher:
Fonukoca   (signed by MaxSpeedy (New Media Holdings Ltd.))

Product:
Ronekudeb

Description:
Ronekudeb Setup

Version:
3.8.3.1

MD5:
1997795264190f81273adda01baa1131

SHA-1:
826495dbb05882f3fe04120f42beea2769979e7b

SHA-256:
b4b3d32cde0d7e587bb00cb2912b536dd754bfaf8cb4fd1c9f87f2d5b157c845

Scanner detections:
1 / 68

Status:
Adware

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Description:
This is also known as bundleware, or downloadware, which is an downloader designed to simply deliver ad-supported offers in the setup routine of an otherwise legitimate software.

Analysis date:
11/5/2024 11:13:49 PM UTC  (a few moments ago)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.NewMedia.NMH.Bundler (M)
16.3.24.20

File size:
1 MB (1,065,432 bytes)

Product version:
4.0.8

File type:
Executable application (Win32 EXE)

Bundler/Installer:
installCore (using Inno Setup)

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\installer_directx_spanish.exe

Digital Signature
Signed by:
MaxSpeedy (New Media Holdings Ltd.)

Authority:
GlobalSign nv-sa

Valid from:
12/17/2015 6:18:08 PM

Valid to:
6/10/2016 8:28:16 PM

Subject:
CN=MaxSpeedy (New Media Holdings Ltd.), O=MaxSpeedy (New Media Holdings Ltd.), L=Tel Aviv, C=IL

Issuer:
CN=GlobalSign CodeSigning CA - SHA256 - G2, O=GlobalSign nv-sa, C=BE

Serial number:
1121E3B958E0D3FCF0CA178C56C74D3BBA4B

File PE Metadata
Compilation timestamp:
6/20/1992 3:52:17 AM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:bo3QKQW+Z0wU12EK/b+EW6/xVnCuqcR5/McUx1Uj:bQjHM0we2Xj+E7nCufvMcUx12

Entry address:
0x9C40

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, 86, 94, FF, FF, E8, 8D, A6, FF, FF, E8, 1C, A9, FF, FF, E8, 53, C9, FF, FF, E8, 9A, C9, FF, FF, E8, C9, F2, FF, FF, E8, 30, F4, FF, FF, 33, C0, 55, 68, FC, A2, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, C5, A2, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 96, FE, FF, FF, E8, C9, FA, FF, FF, 8D, 55, F0, 33, C0, E8, 83, CF, FF, FF, 8B, 55, F0, B8, 24, CE, 40, 00, E8, 32, 95, FF, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, 24, CE...
 
[+]

Entropy:
7.9085

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
37 KB (37,888 bytes)

The file installer_directx_spanish.exe has been seen being distributed by the following 3 URLs.

http://www.bundlebitscontent.com/WVl6OTRQVzkxUWxVNVlqUTRkVWhLYUNVeVFtMVVlR1JuY3pkcmRVTmxWelYyZGlVeVFtb2xNa1prZERKTVdXNGxNa1pOTVZSbVp5VXpSQ1pqUFRkRVkyOUllbk15YkZwd2NGWlNjR3BNZEVVNFRTVXlRblZNZVRCRVZtOWpTWEFsTWtaYWNub3plRU5sYkdKaU5Ha3pNbmRVY0dodVRXOUlkRmRtVW0xRFpWSklTbWRRVUhFM05ubHlXR2N3UnpKNVYyeHhKVEpHZURkTmVrTjFZa1ZoV0RsR2MyeDFKVEpDYjI0NWVXSldkRXRwZHpBM1RVdzVSRmxzWjJoTFJsVk9lSHBFVjBvbVpHOTNibXh2WVdSQmN6MXBibk4wWVd4c1pYSmZaR2x5WldOMGVGOVRjR0Z1YVhOb0xtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbmh0YkdsdWMzUmpjQzFtY0cwdWNHOXlkR0ZzTFdaaFkzUnZjbmt1WTI5dEpUSkdZMjFrSlRKR1pYSnliM0pmYVdNdWNHaHdKVE5HZUhKcGNDVXpSREV5TUM0MU5pNHlNakl1TnpFbE1qWmpiM1Z1ZEhKNVlUSWxNMFJKVGlVeU5uQmhjblJ1WlhJbE0wUlRSVThsTWpadmNtbG5aVzRsTTBSVFJVOGxNalp3Y205bmNtRnRKVE5FUkdseVpXTjBXQ1V5TmpOa2NHRnlkSGxmWTJoaGJtNWxiQ1V6UkZORlR6QXdXams0TUdVelltTXhaamt3TWpaallUaGtORFU0TURjeU1tWmtOVGRqWmpjNEpUSTJiM1VsTTBSb2RIUndKVEkxTTBFbE1qVXlSaVV5TlRKR1pHbHlaV04wZUM1amIyMHVaWE1sTWpaa2RTVXpSR2gwZEhBbE1qVXpRU1V5TlRKR0pUSTFNa1prYjNkdWJHOWh

http://www.bundlebitscontent.com/WVl6OTRQVVJyUVU5ckpUSkNVa0paYmxobU9URTBjRXBNZFVaRlNIQktjVGcwTmxSb1ExRWxNa0poUjB0ck5XZEhRMDF6SlRORUptTTlWWE01TWpGWFlXRmtXV1JDWVhwaVZtODBSMEZuUzJrM01Hc2xNa0pNUVhoVU1IQlFjQ1V5UmxGQkpUSkNkMUZQZVdsbVlUaHZjVkpKVjJSVWNrMXVWakJPSlRKQ1JEQmhSekZOZFZOWGMzRnpPRzVJZG10UVNHaElORGxhT0VaUlpYUjJjWFprTlc4ME1XZHRhRGgwV0Rac1pGRkdUa0V3VFRCeGNYQTJkekJKVmtzNFFsaG9hU1prYjNkdWJHOWhaRUZ6UFdsdWMzUmhiR3hsY2w5a2FYSmxZM1I0WDFOd1lXNXBjMmd1WlhobEptWmhiR3hpWVdOclgzVnliRDFvZEhSd0pUTkJKVEpHSlRKR2VHMXNhVzV6ZEdOd0xXWndiUzV3YjNKMFlXd3RabUZqZEc5eWVTNWpiMjBsTWtaamJXUWxNa1psY25KdmNsOXBZeTV3YUhBbE0wWjRjbWx3SlRORU1UQTJMakl4T1M0ME1TNHhPRE1sTWpaamIzVnVkSEo1WVRJbE0wUkpUaVV5Tm5CaGNuUnVaWElsTTBSVFJVOGxNalp2Y21sblpXNGxNMFJUUlU4bE1qWndjbTluY21GdEpUTkVSR2x5WldOMFdDVXlOak5rY0dGeWRIbGZZMmhoYm01bGJDVXpSRk5GVHpBd1dqazRNR1V6WW1NeFpqa3dNalpqWVRoa05EVTRNRGN5TW1aa05UZGpaamM0SlRJMmIzVWxNMFJvZEhSd0pUSTFNMEVsTWpVeVJpVXlOVEpHWkdseVpXTjBlQzVqYjIwdVpYTWxNalprZFNVelJHaDBkSEFsTWpVelFTVXlOVEpHSlRJMU1rWmtiM2R1Ykc5aFpDNXB

http://www.bestcleanshare.com/WVl6OTRQVTF1ZDJwTmNVRXdibmNsTWtZeVZqTm9jSGx6YUVWVE5tOUVZVkZ4YkhCUFZYTnhVMWRIT1VoYVJVRk1jeVV6UkNaalBWWmFZekF5Wm5sQk5HRmphVlpIUlZCM1ZGVldXRXMyTXlVeVFuaExVbUptYVRsMVZWaDNNekp2UW1sUk1YaDFNbTVNVUhCamMyRktUVFZyZUdWNFRqazFRblJFYjJwTlJHbDNSakpNVDFWdVJsSnllVzF0YmpkQ2JVNXNhVXhoUkZaQ2MwbDZPRFZUYWlVeVFtVXhkMjgyV2xKdlNXcENjRXBYTkU5aWRVRkdaMWx4T0Naa2IzZHViRzloWkVGelBXbHVjM1JoYkd4bGNsOWthWEpsWTNSNFgxTndZVzVwYzJndVpYaGxKbVpoYkd4aVlXTnJYM1Z5YkQxb2RIUndKVE5CSlRKR0pUSkdlRzFzYVc1emRHTndMV1p3YlM1d2IzSjBZV3d0Wm1GamRHOXllUzVqYjIwbE1rWmpiV1FsTWtabGNuSnZjbDlwWXk1d2FIQWxNMFo0Y21sd0pUTkVNVEUzTGpJeU5TNHlOaTQxTUNVeU5tTnZkVzUwY25saE1pVXpSRWxPSlRJMmNHRnlkRzVsY2lVelJGTkZUeVV5Tm05eWFXZGxiaVV6UkZORlR5VXlObkJ5YjJkeVlXMGxNMFJFYVhKbFkzUllKVEkyTTJSd1lYSjBlVjlqYUdGdWJtVnNKVE5FVTBWUE1EQmFPVGd3WlROaVl6Rm1PVEF5Tm1OaE9HUTBOVGd3TnpJeVptUTFOMk5tTnpnbE1qWnZkU1V6UkdoMGRIQWxNalV6UVNVeU5USkdKVEkxTWtaa2FYSmxZM1I0TG1OdmJTNWxjeVV5Tm1SMUpUTkVhSFIwY0NVeU5UTkJKVEkxTWtZbE1qVXlSbVJ2ZDI1c2IyRmtMbWx1YzNSelpXOHVZMj

Remove installer_directx_spanish.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.